> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Registries (RG)

- URL: /taxonomies/software-factory/registries/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T13:00:28.634Z
- Description: Registries (RG): 13 threats in the software factory threat taxonomy. Public package and image registries, internal artifact repositories, proxies and mirrors.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Registries

**Station 10 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix RG**

A registry turns a name into bytes, and every consumer trusts that the name still means what it meant yesterday. These cards cover public package and image registries, internal artifact repositories, and the proxies and mirrors between them.

**Scope:** Public package and image registries, internal artifact repositories, proxies and mirrors.

![Table: Registries (RG), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/113/taxonomy-table-10-RG.png =1400x4922)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="rg-a"></span>**RG·A** Publisher Account Takeover
- <span id="rg-k"></span>**RG·K** Mutable Version or Tag
- <span id="rg-q"></span>**RG·Q** Internal Release Overwrite
- <span id="rg-j"></span>**RG·J** Virtual Repository Shadowing
- <span id="rg-10"></span>**RG·10** Registry Infrastructure Compromise
- <span id="rg-9"></span>**RG·9** Stale Proxy and Mirror
- <span id="rg-8"></span>**RG·8** Name and Namespace Squatting
- <span id="rg-7"></span>**RG·7** Cross-Ecosystem Mirroring
- <span id="rg-6"></span>**RG·6** Trusted Domain Abuse
- <span id="rg-5"></span>**RG·5** Popularity Signal Manipulation
- <span id="rg-4"></span>**RG·4** Private Artifact Exposure
- <span id="rg-3"></span>**RG·3** Retention Gap
- <span id="rg-2"></span>**RG·2** Upstream Availability

## Where this station touches others

- **Registries and Firewall and Quarantine:** the registry is where components live; the firewall decides which of them reach a build.

## Seen in the wild

- **RG·A Publisher Account Takeover:** ua-parser-js (2021); npm chalk and debug phishing (2025).
- **RG·10 Registry Infrastructure Compromise:** Docker Hub breach (2019); PEAR server (2019).
- **RG·9 Stale Proxy and Mirror:** Go module proxy cached typosquat (Socket, 2025).
- **RG·7 Cross-Ecosystem Mirroring:** Shai-Hulud 2.0, npm to Maven Central (2025).
- **RG·5 Popularity Signal Manipulation:** StarJacking (Checkmarx, 2022).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 9 cleanly and 4 only loosely. CAPEC 3.9 has a pattern that describes 5 of them directly, only a generic parent pattern for 7, and nothing for 1. CWE 4.20 names the weakness directly for 8, has only a broader weakness for 5,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Registries (RG), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/113/software-factory-mapping-table-10-RG.png =1400x2146)

---

← [Provenance and Attestation (PV)](/taxonomies/software-factory/provenance-and-attestation/) · [Software factory overview](/taxonomies/software-factory/) · [Firewall and Quarantine (FW)](/taxonomies/software-factory/firewall-and-quarantine/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*